2bebd0687e7f0c941a7eeefc27cba39520ae631e16b21b61179d1f989c212cfb

Target
firefox.exe
Size 5.2MB
Sample261107-lwanqaa12s
SHA256 2bebd0687e7f0c941a7eeefc27cba39520ae631e16b21b61179d1f989c212cfb
MD5 b3bf72f8ccf4f32301418951af5513e6
SHA1 874ce0252e8b5866f429bd726a65add81b62aa87
SHA512 7d2b37e17ed96f7552f4369bf78db66e2fcccb40e14d0640ec49c588f72b77dcee2b402b4e6391afefb133bcd5a973344bedb10b8199e3ad773a414154d9c1ab
SSDEEP 98304:iYhL+dtkB4BgZQspXMB5v+6rdVjqgzRYrixWt035DxC:fSHBu1XobRVk+y035Dx
TLSH
T1D64612AD6284379CC41FC5745133ED06E2B6166E0BEAE5BA77CB7AD077BB400D602B09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  firefox.exe
- Size 5.2MB
- SHA256 2bebd0687e7f0c941a7eeefc27cba39520ae631e16b21b61179d1f989c212cfb
- MD5 b3bf72f8ccf4f32301418951af5513e6
- SHA1 874ce0252e8b5866f429bd726a65add81b62aa87
- SHA512 7d2b37e17ed96f7552f4369bf78db66e2fcccb40e14d0640ec49c588f72b77dcee2b402b4e6391afefb133bcd5a973344bedb10b8199e3ad773a414154d9c1ab
- SSDEEP 98304:iYhL+dtkB4BgZQspXMB5v+6rdVjqgzRYrixWt035DxC:fSHBu1XobRVk+y035Dx
- TLSH
  T1D64612AD6284379CC41FC5745133ED06E2B6166E0BEAE5BA77CB7AD077BB400D602B09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery vmprotect
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

VMProtect packed file

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2